September 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] security problem with kdm settings
by Bob Vickers 21 Sep '01

21 Sep '01

Richard, Thanks for the hint. It is indeed /sbin/conf.d/SuSEconfig.kdm2 that causes the file to revert when it copies stuff from /opt/kde2/share/config/SuSE/config/ But I think kcontrol is the guilty party; it is either bad design or a bug which causes it to save user customisations in /opt rather than /etc . Bob On Fri, 21 Sep 2001, Richard Witt wrote: > Bob Vickers wrote: > > > > > I believe that the settings revert when I install other software; perhaps > > when SuSEconfig runs. > > > > > Hello Bob, > > I have encountered a problem similar to your in the past (although it > was on a SuSE 7.0 system). If I remember correctly, it was indeed due > to SuSEconfig. On my system, the related scripts are in /sbin/conf.d. > You should look at SuSEconfig.kdm or SuSEconfig.kdm2. > > > Hope this helps, > Richard > > -- > << "They that can give up essential liberty, >> > << to purchase a little temporary safety, >> > << deserve neither liberty nor safety." >> > -- Benjamin Franklin > > ---***---***---***---***---***---***---***---***---***---***---***--- > Richard Witt Phone: (330) 672-0096 > Dept. of Physics, Kent State University Email: witt(a)cnr2.kent.edu > ---***---***---***---***---***---***---***---***---***---***---***--- > > ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

1 0

RE: [suse-security] Sendmail
by Wilhelm Tesnaar 21 Sep '01

21 Sep '01

Hi all I am having a problem with allowing a user relaying off my sendmail server/firewall. How can I configure my mail server to allow relaying of mail for a specific user without it being open to the whole world for relaying ? This user roams a lot around the world so Ip's are noit static? I am running standard Suse linux 7.1 Help I am desperate! Regards Willie Tesnaar Regards Willie Tesnaar

8 7

Re: [suse-security] Sendmail
by Annette Jaekel 21 Sep '01

21 Sep '01

Sorry, my last posting goes only to Wilhelm itself. This is my answer: Wilhelm Tesnaar wrote: > >> You wrote, Your mail server is on a firewall? >> Substantiate the problem please. > > Sorry, the error message comes from sendmail under the /var/log/mail file > where it is saying Relaying denied. > I have added the user under access.db, the domain, everything I have tried. > The only time it works, is where I place the Ip address of the user in > there. > ... I had a short discussion with another postmaster about Your problem. We agreed, that the entry of the mail address in Your access.db should allow the relaying. Sorry for another dump question: Did you "makemap" the access.db? And: Did You try to write a finer version of entry: From: user(a)unique.domain RELAY It should work since SuSE 7.1's sendmail with "From:" and "To:" specification. Another 2 proposals: 1) Maybe You should try to enable a sendmail feature for sendmail.cf: FEATURE(`delay_checks') You have to recreate sendmail.cf with "m4" from an .mc file with the above feature. follows description of delay_checks from sendmails cf-README: delay_checks The rulesets check_mail and check_relay will not be called when a client connects or issues a MAIL command, respectively. Instead, those rulesets will be called by the check_rcpt ruleset; they will be skipped under certain circumstances. See "Delay all checks" in "ANTI-SPAM CONFIGURATION CONTROL". 2) You can use SMTP AUTH, recommended sometimes in this thread. My information about SMTP AUTH for sendmail is: Since SuSE 7.1 there is a package in "sec": sendmail-tls Substitute standard sendmail package with this one, You get support for TLS and SMTP AUTH. Annette ... > > Regards > Willie Tesnaar

1 0

Recommended cookie suppression extension for Squid?
by Ralph Seichter 21 Sep '01

21 Sep '01

Morning... I have used WebWasher for cookie suppression for quite some time now, and I think it is a great product. Alas, I want to try Squid as a combined filter/cache, so I am looking for a similar feature to handle cookies based on flexible rules. Internet searches returned Squid extensions like "adzap" ( http://www.zip.com.au/~cs/adzap/ ). What tool do *you* prefer for Squid cookie suppression? BTW, I consider this security related because I don't like the idea of being watched and measured by a trail of cookies, but if there's a different mailing list you suggest for this kind of topic, please point me to it. Thank you. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

nfs on susefirewall2
by Purple Shirt 21 Sep '01

21 Sep '01

Hello, I have a working nfs server on susefirewall2 box (suse 7.2). I know its working because I put the firewall on unprotect status. If I put it on protect status for internal I can't mount internally. I put this into susefirewall2.rc.config: # Common: ssh smtp domain FW_SERVICES_INT_TCP="smtp domain ftp ssh www telnet 111 139 2049" # Common: domain syslog FW_SERVICES_INT_UDP="111 2049" # For VPN/Routing which END at the firewall!! FW_SERVICES_INT_IP="" This o[pens up portmap and nfs server ports, 111 and 2049. But it doesn't work. Maybe the firewall script should contain more options as: FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" as in FW_SERVICE_NFS FW_SERVICE_NTPD ... ... Well I'd appreciate comments on how to make suse's firewall work with nfs. Thanks, mk _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

things bouncing
by jfweber＠eternal.net 21 Sep '01

21 Sep '01

*******Where does a newborn go from here? The net is vast , and infinite********* Hey guys, mail to this list seems to be generating bounced messages some alegedly from amil servers caliming I am infected w/ the wurm under discussion the past couple of days! ** From: Postmaster(a)rectus.de ** To: jfweber(a)eternal.net ** Subject: Content Warning from MailScan to Mail-Sender! ** ** The following email you sent was not delivered to the recipient(s) ** as it had restricted contents inside it. ** ** The restricted content present was: readme.exe ** ** ========================================================== ** The Mail came from : jfweber(a)eternal.net ** The Mail recipient : seibold(a)rectus.de ** Subject of the Mail : Re: [suse-security] Nimda Worm - BugTraq ** Message-ID : <E15k7cH-0007e3-00(a)dfw-mmp3.email.verio.net> ** ** The Mail had following attachments: ** ========================================================== obviously it had no attachments so someone has a really tight squeeze on thier incoming... but it is going to casue a lot of problems if things keep bouncing... Blondely, j afterthought: "Never trust a dog to watch your food." Patrick, age 10

3 2

authldap and apache
by alois blasbichler 20 Sep '01

20 Sep '01

hello, i have a question i have The suse Email server II with apache 1.3.12-128 and openldap1.2.12-3 and the module authldap 1.4.3-15 authldap works fine with the parameter: require valid-user but with the parameter: require group cn=beispiel it does not work in the error log of apache i seee the error: user bind as uid=aa, dc=domain, dc=it failed: LDAP error:invalid credentials: URI /directory/ it seems that the password ist incorrect but it isnt can someone help me alois

2 1

[suse-security] Hack-Attack?
by Markus Kohli 20 Sep '01

20 Sep '01

Hi list! A stupid question of mine again... I already searched the internet, but didn't find any suitable information. I had the following entry in my firewall-log: Sep 20 22:32:04 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 195.217.171.5:3675 xx.x.x.xx:80 L=44 S=0x10 I=38515 F=0x4000 T=106 SYN (#6) Sep 20 22:32:06 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 195.217.171.5:3675 xx.x.x.xx:80 L=44 S=0x10 I=32117 F=0x4000 T=106 SYN (#6) Since I'm on a Cable-Internet, the second address, i.e. the destination, is an internal address. Am I wrong in suspecting that the possible suspect has come from inside that "internal" network? How else should he have got that IP? Plus, what port is that, he's coming from? TIA Markus

2 3

nimda and squid
by Tilo Riemer 20 Sep '01

20 Sep '01

hello, I tried to activate blocking of nimda files (*.eml) via squid. but squid did not block any elm-file. I tested it with squid coming qith suse 6.3 and with the newest swuid from suse for suse 7.0. the same config file works with the current squid on a freebsd box, and I heard that squid also works on some debian boxes. cu, Tilo

6 6

things bouncing
by jfweber＠eternal.net 20 Sep '01

20 Sep '01

*******Where does a newborn go from here? The net is vast , and infinite********* Hey guys, mail to this list seems to be generating bounced messages some alegedly from amil servers caliming I am infected w/ the wurm under discussion the past couple of days! ** From: Postmaster(a)rectus.de ** To: jfweber(a)eternal.net ** Subject: Content Warning from MailScan to Mail-Sender! ** ** The following email you sent was not delivered to the recipient(s) ** as it had restricted contents inside it. ** ** The restricted content present was: readme.exe ** ** ========================================================== ** The Mail came from : jfweber(a)eternal.net ** The Mail recipient : seibold(a)rectus.de ** Subject of the Mail : Re: [suse-security] Nimda Worm - BugTraq ** Message-ID : <E15k7cH-0007e3-00(a)dfw-mmp3.email.verio.net> ** ** The Mail had following attachments: ** ========================================================== obviously it had no attachments so someone has a really tight squeeze on thier incoming... but it is going to casue a lot of problems if things keep bouncing... Blondely, j afterthought: "Never trust a dog to watch your food." Patrick, age 10

1 0